Sensitive information stored to network drive such as a cloud service may be put at risk by the malicious behavior of users of the network. For example, a user may download a confidential document stored to the cloud service and take subsequent actions that jeopardize the security of the downloaded document. Accordingly, detecting malicious behavior of users may maintain the confidentiality of information.